Skip to main content
Connect OpenAI’s Codex CLI to Agent Vault so it can check out and sign in for you, using only mock tokens. It takes about 2 minutes: one command adds the server and starts the sign-in.

Copy the line for Codex from your dashboard, then add the server and sign in.

​
Before you start

  • An Agent Vault account, with a card if your agent will check out. New here? The Quickstart sets one up in about 5 minutes.
  • The Codex CLI, installed and signed in.

​
Connect Codex

1

Paste this into Codex

Codex reads the connect skill and adds the server. If your browser is on the same machine, that also starts the sign-in.
2

Sign in

Open the sign-in link Codex gives you and sign in on the Agent Vault sign-in page, with your Agent Vault account.
3

Start a new session

Codex keeps the MCP servers it started with, so the session you pasted into won’t see Agent Vault. Start a new Codex session for the next steps.

​
Choose what it may use

A new connection starts with nothing granted, so your agent can’t use a card or a login yet. Until you choose, its first tool call answers:
The connection itself appears in the dashboard only once your agent makes its first tool call, so make that call first.
1

Make a first call

Ask your agent to call get_token_catalog. It answers with the message above, and the call creates the connection.
2

Open Connected apps

In the dashboard sidebar, under Vault, click Connected apps. The new connection’s row shows Choose what it may use.
3

Pick its cards and logins

Click Choose access. Under Cards and Logins, pick All, or keep Only selected and tick the ones this agent may use.
4

Check the choices, then click Save access

Your first connection’s dialog opens with nothing ticked. After that, a new connection’s dialog opens with the choices of the connection you used most recently, so saving it unchanged grants the same cards and logins, and the same three switches: Let this app create and change its own logins, Ask me before every purchase from this app and Fill a test card instead of my card. Check all of them for this agent before you click Save access.
You can change or revoke the connection on the same page at any time. See Connected apps.

​
Check it works

In a new Codex session, ask Codex to call the Agent Vault tool get_token_catalog. It answers with the mock tokens for the cards and logins you allowed, such as av_card_1_number_u7x2k. Your real card number never reaches Codex.

​
Troubleshooting

A running session keeps the MCP servers it started with. Start a new session and ask again.
It is waiting for the sign-in callback, which can’t reach a remote machine. Stop it, add the server to ~/.codex/config.toml and sign in with codex mcp login agent-vault --no-browser.
The connection has nothing granted yet. Follow Choose what it may use, then ask again.

​
Next

Your first checkout

Have Codex buy something, start to finish.

Tool reference

Every tool your agent now has.